Malicious PDF — malware analysis report

Static analysis result for SHA-256 920a8e27a6c0d557…

MALICIOUS

PDF

241.4 KB Created: 2021-06-25 06:56:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: d65517c60bb9e177de21061f7c733337 SHA-1: aee797c4b332a7dbd2ac1bf980af64695d205c4a SHA-256: 920a8e27a6c0d557fc52a5f8fa7a3546dec073db16e25c39ee959a55cc61a80f
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged by multiple heuristics, including ML classification and ClamAV, as malicious. The critical 'SE_SECRET_RECOVERY_LURE' heuristic indicates the document attempts to trick the user into revealing sensitive recovery information. The presence of numerous external URLs, many pointing to compromised WordPress sites, suggests a phishing or credential harvesting campaign. No scripts were extracted, but the document's structure and embedded URLs are indicative of a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://garglob.ru/uplcv?utm_term=zoll+r+series+service+manual PDF link annotation
    • https://soechi.com/userfiles/file/26504634080.pdfIn PDF document text
    • https://www.pietri-automobiles.com/wp-content/plugins/super-forms/uploads/php/files/6odpume0ocj7g6elkbtt0h1aaa/4753834249.pdfIn PDF document text
    • http://cageart.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607eb77870dc0---70368325605.pdfIn PDF document text
    • https://alshamiltrading.com/alshamilfiles/file/54200966143.pdfIn PDF document text
    • https://www.hintonassociates.com/wp-content/plugins/super-forms/uploads/php/files/951c6b1387d4c97c941f910aa4b6850e/lisaba.pdfIn PDF document text
    • http://www.hcibatiment.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1607777215c93d---58962420692.pdfIn PDF document text
    • http://www.qookspot.kitchen/wp-content/plugins/formcraft/file-upload/server/content/files/1607b62d6ec2fe---75457909141.pdfIn PDF document text
    • http://www.sarajevo-inn-grunewald.com/wp-content/plugins/formcraft/file-upload/server/content/files/16097b3a545a41---lomapowupa.pdfIn PDF document text
    • https://edoxmarketing.com/wp-content/plugins/super-forms/uploads/php/files/s6qqp1n3lh8d8ecnilbr0023i1/69060921486.pdfIn PDF document text
    • http://interwork.sk/userfiles/file/xegobulikedijeto.pdfIn PDF document text
    • http://www.urbanwaterways.info/files/bixojigedexop.pdfIn PDF document text
    • https://leesman.com/wp-content/plugins/super-forms/uploads/php/files/cca0b5cc2e3c0829b57997296c03d749/59470561692.pdfIn PDF document text
    • https://agsposure.org/wp-content/plugins/super-forms/uploads/php/files/79b83d983d8f19fabb4d8f7eecc0735f/767578991.pdfIn PDF document text
    • http://bio86.fr/fichiers/87169351384.pdfIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00036db9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x36DB9 2564 bytes
SHA-256: e813080639a3e93ee5f53f360204ff9fa06fce1b9a87fd9f788caa72cbd23bab
font_01_sfnt_off00037906.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37906 4960 bytes
SHA-256: 6857aecb6d4d25421e47813fb38ad8c1d366d26f1cda244feb71d84e64fbfd24
font_02_sfnt_off000389d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x389D1 13116 bytes
SHA-256: f6396640e4a3570903468c634cc8a556b6c7176dce8ff9324dde67942e7edf52

Open this report in the interactive analyzer, or submit your own file for analysis.